Identity Awareness on Shared Terminal Servers
A 4,200-user company publishes a Citrix farm with three Windows Server 2019 terminal servers, each hosting 70 concurrent sessions. The Check Point R81.10 gateway currently uses AD Query plus Browser-Based Authentication. Users authenticate to a captive portal once per terminal server IP, so the first user's identity is applied to all 70 sessions on that IP. The security team sees finance users' traffic attributed to a helpdesk account and cannot enforce per-user HTTPS inspection exceptions. There is no Identity Agent on the endpoints and no plan to deploy one to 4,200 devices. RADIUS accounting is available from the Citrix StoreFront but not from the terminal servers. The company wants per-session identity for URL filtering and Application Control without breaking single sign-on.
1. Why do AD Query and browser-based authentication fail to provide per-session identity on these terminal servers?
Read the worked answer
Both methods are ultimately IP-centric in this deployment. AD Query reads logon events from domain controllers and associates a user with an IP address. On a terminal server, many users share one IP, so the last or first logon event can overwrite the mapping. Browser-Based Authentication authenticates a user through a captive portal and then binds that identity to the source IP. The first user who authenticates claims the terminal server IP for all 70 sessions.
RADIUS accounting from StoreFront is also insufficient because it identifies the user at the Citrix layer but does not reliably map each session to the terminal server's source IP and port at the gateway. The result is exactly what the customer sees: finance traffic attributed to a helpdesk account, and per-user HTTPS inspection exceptions cannot be enforced. The missing control is session-level identity from the terminal server itself, not another IP-based source.
2. Which identity method would you deploy, and in what order should the identity sources be evaluated?
Read the worked answer
Deploy Check Point Terminal Server Agent on the three Citrix servers. It runs server-side, so it does not require an Identity Agent on 4,200 endpoints. It monitors user sessions on the terminal server and sends user-to-session-to-IP mappings to the gateway, which gives per-session identity for URL filtering and Application Control.
Identity source order:
- Terminal Server Agent first for Citrix traffic. It provides the most specific identity and should override IP-based sources.
- AD Query second as a fallback for normal managed PCs and for users who are not on Citrix.
- Browser-Based Authentication last, only for unmanaged or guest devices where no agent identity exists.
Do not use RADIUS accounting from StoreFront as the primary source; it does not provide the terminal server session mapping. After deployment, test with two users on the same terminal server opening different finance and helpdesk sessions, and confirm the gateway logs show different user names for the same source IP.
3. How would you use the new identity to enforce per-user HTTPS inspection exceptions without breaking single sign-on?
Read the worked answer
Use identity-aware rules with the Terminal Server Agent identity as the source. Create an exception group for Finance and HR and place an HTTPS inspection rule above the generic inspection rule: source = Finance_HR identity group, action = Inspect; generic users can be set to Bypass inspection but still receive IPS and Application Control. Because the identity is session-level, two users on the same terminal server IP can match different rules.
Keep authentication transparent: Terminal Server Agent should pass the logged-on user without another portal prompt. For unknown identities, fall back to a UserCheck or captive portal only for that session, not for the whole terminal server IP. Verify with pdp identity queries and logs that finance sessions are inspected and helpdesk sessions are not. The main risk is rule order: an IP-based rule above the identity rule will defeat the design. Put the identity exception first and log every match during the pilot.